Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
2answers
83 views

How does salting increase security? [duplicate]

I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
1
vote
4answers
199 views

Password protect an excel file for a period of time?

I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options. Ideally: Enter the password File works for a week(/other period of time) After a ...
1
vote
2answers
114 views

What happens after setting up HDD password?

I am wondering what happens when I set HDD password in my laptop (Samsung with ssd). I mean a given case. I have been having working system without any password. Then one day I decide to set up HDD ...
1
vote
1answer
86 views

how to rememeber passwords securely?

Imagine you have a private RSA-key on your computer encrypted (through PBKDF2, AES-CTR, HMAC256) with a password, now if the user would like to tick "Remember Password", what is the most secure way to ...
8
votes
4answers
1k views

Are efforts being made to bring about password standards?

Rather than adopting a universal standard, many websites develop their own guidelines for how passwords should be constructed. When you consider the number of passwords the average person today has ...
29
votes
5answers
7k views

Why are brute-force password-cracking attacks not automatically detected and thwarted?

Why doesn't software automatically detect password-cracking attacks, and thwart them? Long version: Suppose that someone tries a brute-force password-cracking attack on some program XYZ that ...
1
vote
3answers
70 views

How to limit the need to type a long master passphrase to only once per login session?

I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1. I'd like to ...
2
votes
1answer
70 views

Credential In Windows [closed]

How can I view the Credentials stored in Windows? Is there any possible way to view the stored password? I can just export them..
10
votes
4answers
3k views

Authenticating without a database

I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database? Would it be the exact same process if you stored ...
1
vote
0answers
57 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
20
votes
5answers
4k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit ...
1
vote
2answers
198 views

In what situations can a hacker try to break passwords millions of times? [duplicate]

I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a ...
1
vote
2answers
343 views

VPN over HTTPs for a web service only

I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). ...
11
votes
7answers
761 views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
1
vote
1answer
369 views

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
0
votes
1answer
157 views

Did somebody connect to my facebook account?

I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true? There ...
2
votes
2answers
110 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
3
votes
3answers
371 views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
4
votes
3answers
183 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
8
votes
3answers
4k views

How often do two users use the same password

If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
70
votes
8answers
9k views

Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
0
votes
2answers
222 views

Storing multiple hashes to prevent collisions, security risk?

This is all just for curiosity's sake, so discussion on which hashing algorithm is harder/better/faster/stronger is irrelevant. But my question/thought is this.. With regards to password storage, and ...
1
vote
1answer
151 views

Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?

I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
42
votes
5answers
4k views

Is it safe to tell your users what kind of hashing algorithm you use?

For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
1
vote
2answers
85 views

In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?

I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight). ...
-1
votes
4answers
136 views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
0
votes
2answers
68 views

In addition to using strong hash algorithms, what is a good “password requirement”? [duplicate]

Assuming the use of bcrypt/scrypt: Would it be a good idea to "require" a password of at least 12 characters, also mentioning the possibility of using long passphrases, instead of your typical ...
2
votes
2answers
273 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced ...
3
votes
7answers
181 views

Is providing a website password over the phone any less secure than other identifying information?

I've been dealing with two separate banks for completing a 401k rollover (I do not have any other accounts with either of the two banks), and I've encountered something with both that I've never seen ...
2
votes
4answers
216 views

Should we rethink our entire password strategy? [closed]

Passwords get discussed a lot on this site, and there's quite a lot for both users and sites to do, to stay in line with "best practice". Web sites need a password strength policy, account lockout ...
4
votes
2answers
61 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
1
vote
6answers
221 views

Why not use weak passwords?

In a specific situation: online stores that cannot possibly store payment details because you pay using paypal, but require registration. What reason is there to use good passwords here? Breaking ...
19
votes
4answers
3k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
21
votes
3answers
4k views

Doesn't plaintextoffenders.com just provide attackers with a good list of sites to attack for passwords?

On the face of it, PTO seems like a good idea in educating people about password security. On the other hand, if I were an attacker, PTO would be the first place I would start if I wanted to start ...
10
votes
4answers
1k views

Does the strength of password matter in bcrypt?

Even if I choose 1 character for my password or 32 characters with numbers, letters, uppercase symbols etc. the bcrypted password will still be 60 characters length password. So does the password ...
2
votes
1answer
69 views

Identical lanman hashes on AD accounts?

I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
1
vote
0answers
53 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
1
vote
2answers
71 views

Are repeating random patterns weaker than non repeating random patterns?

Which would be harder to crack: a password comprising of n characters randomly selected or a password comprising of x randomly selected characters repeated m times so that m*x=n. For example: ...
0
votes
2answers
60 views

how long do lowercase alphabets-only passwords have to be to match more complex ones? [duplicate]

Lowercase-only passwords are convenient for phones since we dont hit shift or go to characters page(each which is as much effort as hitting a character in my Android devices). But how long would a ...
0
votes
2answers
85 views

Timing-safe string comparison in high-level languages

I'm looking for a reliable solution to compare two strings without leaking their content through time differences. The length of the strings is not secret. The background is this: I'm implementing ...
27
votes
5answers
5k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
0
votes
1answer
85 views

How can I tell if my ISP account password is encrypted?

How can I be sure my ISP encrypts my account password? I found out accidentally that mine did not. I had called to report an interruption in service, and in the process of "troubleshooting", the ...
1
vote
0answers
88 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
42
votes
9answers
5k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
1
vote
2answers
180 views

How do I generate a word list from a known seed word? [duplicate]

I've lost my master password. Not all is lost as I know the original word that generated the password: It was generated by a random case switching for consonants and random vocal to numbers. For ...
2
votes
1answer
131 views

Should a space in a password count as a symbol when checking for complexity?

There is no doubt in my mind that spaces should be allowed in passwords. I see some websites disallow spaces, symbols in passwords and even enforce minimum length which seems t otally nonsensical to ...
1
vote
1answer
2k views

Why is it considered safe for services like Mint to store bank password?

My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
1
vote
1answer
63 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
2
votes
1answer
189 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
0
votes
0answers
46 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...